CVE-2025-13704: The Autogen Headers Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head_class' paramete

The Autogen Headers Menu WordPress plugin (all versions up to 1.0.1) has a stored cross-site scripting vulnerability (XSS, where attackers inject malicious scripts into web pages) in the 'head_class' parameter of the 'autogen_menu' shortcode. Authenticated attackers with Contributor-level access or higher can exploit insufficient input sanitization and output escaping to inject arbitrary scripts that execute when users view affected pages.